Model Context Protocol TypeScript SDK authentication and request flaws
A developer toolkit for AI tool links; attackers could get in with another service's key or stall the server.
Summary
Several flaws in the Model Context Protocol TypeScript SDK let a token issued for another service pass on an MCP server, let one request exhaust server memory, mix one client's messages into another's, and send credentials to another origin after a redirect. Servers and clients using the @modelcontextprotocol sdk, server, express, server-legacy, and client packages are affected.
Affected when
- Authorization server issues tokens for multiple services
- App's verifyAccessToken() does not check aud itself
- MCP server reached over HTTP (stdio-only servers are not affected)
- Tools that accept arrays or object keys
- One transport or server instance shared by multiple clients
- HTTP redirects followed by client transports or OAuth requests
What to do
Update @modelcontextprotocol/sdk to 1.32.0, @modelcontextprotocol/server to 2.3.0, @modelcontextprotocol/express to 2.0.2, @modelcontextprotocol/server-legacy to 2.3.1, and @modelcontextprotocol/client to 2.3.0 or later. Upgrading alone leaves audience validation off, so enable aud checking and supply the token audience together; enabling only the expected audience check makes every request return HTTP 401. Shared instances need application code changes, and you should also set a request body size limit and a tool-input element bound.
Update to at least the version for your product:
- @modelcontextprotocol/sdk 1.32.0 or later
- @modelcontextprotocol/server 2.3.0 or later
- @modelcontextprotocol/express 2.0.2 or later
- @modelcontextprotocol/server-legacy 2.3.1 or later
- @modelcontextprotocol/client 2.3.0 or later
Products and platforms
CVE IDs
Sources
Times
First published
First seen